flashrom 

flashrom Svn Source Tree

Root/trunk/at45db.c

  • Property svn:eol-style set to native
1/*
2 * Support for Atmel AT45DB series DataFlash chips.
3 * This file is part of the flashrom project.
4 *
5 * Copyright (C) 2012 Aidan Thornton
6 * Copyright (C) 2013 Stefan Tauner
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; version 2 of the License.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20 */
21
22#include <string.h>
23#include "flash.h"
24#include "chipdrivers.h"
25#include "programmer.h"
26#include "spi.h"
27
28/* Status register bits */
29#define AT45DB_READY(1<<7)
30#define AT45DB_CMP(1<<6)
31#define AT45DB_PROT(1<<1)
32#define AT45DB_POWEROF2(1<<0)
33
34/* Opcodes */
35#define AT45DB_STATUS 0xD7 /* NB: this is a block erase command on most other chips(!). */
36#define AT45DB_DISABLE_PROTECT 0x3D, 0x2A, 0x7F, 0x9A
37#define AT45DB_READ_ARRAY 0xE8
38#define AT45DB_READ_PROTECT 0x32
39#define AT45DB_READ_LOCKDOWN 0x35
40#define AT45DB_PAGE_ERASE 0x81
41#define AT45DB_BLOCK_ERASE 0x50
42#define AT45DB_SECTOR_ERASE 0x7C
43#define AT45DB_CHIP_ERASE 0xC7
44#define AT45DB_CHIP_ERASE_ADDR 0x94809A /* Magic address. See usage. */
45#define AT45DB_BUFFER1_WRITE 0x84
46#define AT45DB_BUFFER1_PAGE_PROGRAM 0x88
47/* Buffer 2 is unused yet.
48#define AT45DB_BUFFER2_WRITE 0x87
49#define AT45DB_BUFFER2_PAGE_PROGRAM 0x89
50*/
51
52static uint8_t at45db_read_status_register(struct flashctx *flash, uint8_t *status)
53{
54static const uint8_t cmd[] = { AT45DB_STATUS };
55
56int ret = spi_send_command(flash, sizeof(cmd), 1, cmd, status);
57if (ret != 0)
58msg_cerr("Reading the status register failed!\n");
59else
60msg_cspew("Status register: 0x%02x.\n", *status);
61return ret;
62}
63
64int spi_disable_blockprotect_at45db(struct flashctx *flash)
65{
66static const uint8_t cmd[4] = { AT45DB_DISABLE_PROTECT }; /* NB: 4 bytes magic number */
67int ret = spi_send_command(flash, sizeof(cmd), 0, cmd, NULL);
68if (ret != 0) {
69msg_cerr("Sending disable lockdown failed!\n");
70return ret;
71}
72uint8_t status;
73ret = at45db_read_status_register(flash, &status);
74if (ret != 0 || ((status & AT45DB_PROT) != 0)) {
75msg_cerr("Disabling lockdown failed!\n");
76return 1;
77}
78
79return 0;
80}
81
82static unsigned int at45db_get_sector_count(struct flashctx *flash)
83{
84unsigned int i, j;
85unsigned int cnt = 0;
86for (i = 0; i < NUM_ERASEFUNCTIONS; i++) {
87if (flash->chip->block_erasers[i].block_erase == &spi_erase_at45db_sector) {
88for (j = 0; j < NUM_ERASEREGIONS; j++) {
89cnt += flash->chip->block_erasers[i].eraseblocks[j].count;
90}
91}
92}
93msg_cspew("%s: number of sectors=%u\n", __func__, cnt);
94return cnt;
95}
96
97/* Reads and prettyprints protection/lockdown registers.
98 * Some elegance of the printouts had to be cut down a bit to share this code. */
99static uint8_t at45db_prettyprint_protection_register(struct flashctx *flash, uint8_t opcode, const char *regname)
100{
101const uint8_t cmd[] = { opcode, 0, 0, 0 };
102const size_t sec_count = at45db_get_sector_count(flash);
103if (sec_count < 2)
104return 0;
105
106/* The first two sectors share the first result byte. */
107uint8_t buf[at45db_get_sector_count(flash) - 1];
108
109int ret = spi_send_command(flash, sizeof(cmd), sizeof(buf), cmd, buf);
110if (ret != 0) {
111msg_cerr("Reading the %s register failed!\n", regname);
112return ret;
113}
114
115unsigned int i;
116for (i = 0; i < sizeof(buf); i++) {
117if (buf[i] != 0x00)
118break;
119if (i == sizeof(buf) - 1) {
120msg_cdbg("No Sector is %sed.\n", regname);
121return 0;
122}
123}
124
125/* TODO: print which addresses are mapped to (un)locked sectors. */
126msg_cdbg("Sector 0a is %s%sed.\n", ((buf[0] & 0xC0) == 0x00) ? "un" : "", regname);
127msg_cdbg("Sector 0b is %s%sed.\n", ((buf[0] & 0x30) == 0x00) ? "un" : "", regname);
128for (i = 1; i < sizeof(buf); i++)
129msg_cdbg("Sector %2u is %s%sed.\n", i, (buf[i] == 0x00) ? "un" : "", regname);
130
131return 0;
132}
133
134/* bit 7: busy flag
135 * bit 6: memory/buffer compare result
136 * bit 5-2: density (encoding see below)
137 * bit 1: protection enabled (soft or hard)
138 * bit 0: "power of 2" page size indicator (e.g. 1 means 256B; 0 means 264B)
139 *
140 * 5-2 encoding: bit 2 is always 1, bits 3-5 encode the density as "2^(bits - 1)" in Mb e.g.:
141 * AT45DB161D 1011 16Mb */
142int spi_prettyprint_status_register_at45db(struct flashctx *flash)
143{
144uint8_t status;
145if (at45db_read_status_register(flash, &status) != 0) {
146return 1;
147}
148
149/* AT45DB321C does not support lockdown or a page size of a power of 2... */
150const bool isAT45DB321C = (strcmp(flash->chip->name, "AT45DB321C") == 0);
151msg_cdbg("Chip status register is 0x%02x\n", status);
152msg_cdbg("Chip status register: Bit 7 / Ready is %sset\n", (status & AT45DB_READY) ? "" : "not ");
153msg_cdbg("Chip status register: Bit 6 / Compare match is %sset\n", (status & AT45DB_CMP) ? "" : "not ");
154spi_prettyprint_status_register_bit(status, 5);
155spi_prettyprint_status_register_bit(status, 4);
156spi_prettyprint_status_register_bit(status, 3);
157spi_prettyprint_status_register_bit(status, 2);
158const uint8_t dens = (status >> 3) & 0x7; /* Bit 2 is always 1, we use the other bits only */
159msg_cdbg("Chip status register: Density is %u Mb\n", 1 << (dens - 1));
160msg_cdbg("Chip status register: Bit 1 / Protection is %sset\n", (status & AT45DB_PROT) ? "" : "not ");
161
162if (isAT45DB321C)
163spi_prettyprint_status_register_bit(status, 0);
164else
165msg_cdbg("Chip status register: Bit 0 / \"Power of 2\" is %sset\n",
166 (status & AT45DB_POWEROF2) ? "" : "not ");
167
168if (status & AT45DB_PROT)
169at45db_prettyprint_protection_register(flash, AT45DB_READ_PROTECT, "protect");
170
171if (!isAT45DB321C)
172at45db_prettyprint_protection_register(flash, AT45DB_READ_LOCKDOWN, "lock");
173
174return 0;
175}
176
177/* Probe function for AT45DB* chips that support multiple page sizes. */
178int probe_spi_at45db(struct flashctx *flash)
179{
180uint8_t status;
181struct flashchip *chip = flash->chip;
182
183if (!probe_spi_rdid(flash))
184return 0;
185
186/* Some AT45DB* chips support two different page sizes each (e.g. 264 and 256 B). In order to tell which
187 * page size this chip has we need to read the status register. */
188if (at45db_read_status_register(flash, &status) != 0)
189return 0;
190
191/* We assume sane power-of-2 page sizes and adjust the chip attributes in case this is not the case. */
192if ((status & AT45DB_POWEROF2) == 0) {
193chip->total_size = (chip->total_size / 32) * 33;
194chip->page_size = (chip->page_size / 32) * 33;
195
196unsigned int i, j;
197for (i = 0; i < NUM_ERASEFUNCTIONS; i++) {
198struct block_eraser *eraser = &chip->block_erasers[i];
199for (j = 0; j < NUM_ERASEREGIONS; j++) {
200eraser->eraseblocks[j].size = (eraser->eraseblocks[j].size / 32) * 33;
201}
202}
203}
204
205switch (chip->page_size) {
206case 256: chip->gran = write_gran_256bytes; break;
207case 264: chip->gran = write_gran_264bytes; break;
208case 512: chip->gran = write_gran_512bytes; break;
209case 528: chip->gran = write_gran_528bytes; break;
210case 1024: chip->gran = write_gran_1024bytes; break;
211case 1056: chip->gran = write_gran_1056bytes; break;
212default:
213msg_cerr("%s: unknown page size %d.\n", __func__, chip->page_size);
214return 0;
215}
216
217msg_cdbg2("%s: total size %i kB, page size %i B\n", __func__, chip->total_size * 1024, chip->page_size);
218
219return 1;
220}
221
222/* In case of non-power-of-two page sizes we need to convert the address flashrom uses to the address the
223 * DataFlash chips use. The latter uses a segmented address space where the page address is encoded in the
224 * more significant bits and the offset within the page is encoded in the less significant bits. The exact
225 * partition depends on the page size.
226 */
227static unsigned int at45db_convert_addr(unsigned int addr, unsigned int page_size)
228{
229unsigned int page_bits = address_to_bits(page_size - 1);
230unsigned int at45db_addr = ((addr / page_size) << page_bits) | (addr % page_size);
231msg_cspew("%s: addr=0x%x, page_size=%u, page_bits=%u -> at45db_addr=0x%x\n",
232 __func__, addr, page_size, page_bits, at45db_addr);
233return at45db_addr;
234}
235
236int spi_read_at45db(struct flashctx *flash, uint8_t *buf, unsigned int addr, unsigned int len)
237{
238const unsigned int page_size = flash->chip->page_size;
239const unsigned int total_size = flash->chip->total_size * 1024;
240if ((addr + len) > total_size) {
241msg_cerr("%s: tried to read beyond flash boundary: addr=%u, len=%u, size=%u\n",
242 __func__, addr, len, total_size);
243return 1;
244}
245
246/* We have to split this up into chunks to fit within the programmer's read size limit, but those
247 * chunks can cross page boundaries. */
248const unsigned int max_data_read = flash->mst->spi.max_data_read;
249const unsigned int max_chunk = (max_data_read > 0) ? max_data_read : page_size;
250while (len > 0) {
251unsigned int chunk = min(max_chunk, len);
252int ret = spi_nbyte_read(flash, at45db_convert_addr(addr, page_size), buf, chunk);
253if (ret) {
254msg_cerr("%s: error sending read command!\n", __func__);
255return ret;
256}
257addr += chunk;
258buf += chunk;
259len -= chunk;
260}
261
262return 0;
263}
264
265/* Legacy continuous read, used where spi_read_at45db() is not available.
266 * The first 4 (dummy) bytes read need to be discarded. */
267int spi_read_at45db_e8(struct flashctx *flash, uint8_t *buf, unsigned int addr, unsigned int len)
268{
269const unsigned int page_size = flash->chip->page_size;
270const unsigned int total_size = flash->chip->total_size * 1024;
271if ((addr + len) > total_size) {
272msg_cerr("%s: tried to read beyond flash boundary: addr=%u, len=%u, size=%u\n",
273 __func__, addr, len, total_size);
274return 1;
275}
276
277/* We have to split this up into chunks to fit within the programmer's read size limit, but those
278 * chunks can cross page boundaries. */
279const unsigned int max_data_read = flash->mst->spi.max_data_read;
280const unsigned int max_chunk = (max_data_read > 0) ? max_data_read : page_size;
281while (len > 0) {
282const unsigned int addr_at45 = at45db_convert_addr(addr, page_size);
283const unsigned char cmd[] = {
284AT45DB_READ_ARRAY,
285(addr_at45 >> 16) & 0xff,
286(addr_at45 >> 8) & 0xff,
287(addr_at45 >> 0) & 0xff
288};
289/* We need to leave place for 4 dummy bytes and handle them explicitly. */
290unsigned int chunk = min(max_chunk, len + 4);
291uint8_t tmp[chunk];
292int ret = spi_send_command(flash, sizeof(cmd), chunk, cmd, tmp);
293if (ret) {
294msg_cerr("%s: error sending read command!\n", __func__);
295return ret;
296}
297/* Copy result without dummy bytes into buf and advance address counter respectively. */
298memcpy(buf, tmp + 4, chunk - 4);
299addr += chunk - 4;
300buf += chunk - 4;
301len -= chunk - 4;
302}
303return 0;
304}
305
306/* Returns 0 when ready, 1 on errors and timeouts. */
307static int at45db_wait_ready (struct flashctx *flash, unsigned int us, unsigned int retries)
308{
309while (true) {
310uint8_t status;
311int ret = at45db_read_status_register(flash, &status);
312if ((status & AT45DB_READY) == AT45DB_READY)
313return 0;
314if (ret != 0 || retries-- == 0)
315return 1;
316programmer_delay(us);
317}
318}
319
320static int at45db_erase(struct flashctx *flash, uint8_t opcode, unsigned int at45db_addr, unsigned int stepsize, unsigned int retries)
321{
322const uint8_t cmd[] = {
323opcode,
324(at45db_addr >> 16) & 0xff,
325(at45db_addr >> 8) & 0xff,
326(at45db_addr >> 0) & 0xff
327};
328
329/* Send erase command. */
330int ret = spi_send_command(flash, sizeof(cmd), 0, cmd, NULL);
331if (ret != 0) {
332msg_cerr("%s: error sending erase command!\n", __func__);
333return ret;
334}
335
336/* Wait for completion. */
337ret = at45db_wait_ready(flash, stepsize, retries);
338if (ret != 0)
339msg_cerr("%s: chip did not become ready again after sending the erase command!\n", __func__);
340
341return ret;
342}
343
344int spi_erase_at45db_page(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
345{
346const unsigned int page_size = flash->chip->page_size;
347const unsigned int total_size = flash->chip->total_size * 1024;
348
349if ((addr % page_size) != 0 || (blocklen % page_size) != 0) {
350msg_cerr("%s: cannot erase partial pages: addr=%u, blocklen=%u\n", __func__, addr, blocklen);
351return 1;
352}
353
354if ((addr + blocklen) > total_size) {
355msg_cerr("%s: tried to erase a block beyond flash boundary: addr=%u, blocklen=%u, size=%u\n",
356 __func__, addr, blocklen, total_size);
357return 1;
358}
359
360/* Needs typically about 35 ms for completion, so let's wait 100 ms in 500 us steps. */
361return at45db_erase(flash, AT45DB_PAGE_ERASE, at45db_convert_addr(addr, page_size), 500, 200);
362}
363
364int spi_erase_at45db_block(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
365{
366const unsigned int page_size = flash->chip->page_size;
367const unsigned int total_size = flash->chip->total_size * 1024;
368
369if ((addr % page_size) != 0 || (blocklen % page_size) != 0) { // FIXME: should check blocks not pages
370msg_cerr("%s: cannot erase partial pages: addr=%u, blocklen=%u\n", __func__, addr, blocklen);
371return 1;
372}
373
374if ((addr + blocklen) > total_size) {
375msg_cerr("%s: tried to erase a block beyond flash boundary: addr=%u, blocklen=%u, size=%u\n",
376 __func__, addr, blocklen, total_size);
377return 1;
378}
379
380/* Needs typically between 20 and 100 ms for completion, so let's wait 300 ms in 1 ms steps. */
381return at45db_erase(flash, AT45DB_BLOCK_ERASE, at45db_convert_addr(addr, page_size), 1000, 300);
382}
383
384int spi_erase_at45db_sector(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
385{
386const unsigned int page_size = flash->chip->page_size;
387const unsigned int total_size = flash->chip->total_size * 1024;
388
389if ((addr % page_size) != 0 || (blocklen % page_size) != 0) { // FIXME: should check sectors not pages
390msg_cerr("%s: cannot erase partial pages: addr=%u, blocklen=%u\n", __func__, addr, blocklen);
391return 1;
392}
393
394if ((addr + blocklen) > total_size) {
395msg_cerr("%s: tried to erase a sector beyond flash boundary: addr=%u, blocklen=%u, size=%u\n",
396 __func__, addr, blocklen, total_size);
397return 1;
398}
399
400/* Needs typically about 5 s for completion, so let's wait 20 seconds in 200 ms steps. */
401return at45db_erase(flash, AT45DB_SECTOR_ERASE, at45db_convert_addr(addr, page_size), 200000, 100);
402}
403
404int spi_erase_at45db_chip(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
405{
406const unsigned int total_size = flash->chip->total_size * 1024;
407
408if ((addr + blocklen) > total_size) {
409msg_cerr("%s: tried to erase beyond flash boundary: addr=%u, blocklen=%u, size=%u\n",
410 __func__, addr, blocklen, total_size);
411return 1;
412}
413
414/* Needs typically from about 5 to over 60 s for completion, so let's wait 100 s in 500 ms steps.
415 * NB: the address is not a real address but a magic number. This hack allows to share code. */
416return at45db_erase(flash, AT45DB_CHIP_ERASE, AT45DB_CHIP_ERASE_ADDR, 500000, 200);
417}
418
419/* This one is really special and works only for AT45CS1282. It uses two different opcodes depending on the
420 * address and has an asymmetric layout. */
421int spi_erase_at45cs_sector(struct flashctx *flash, unsigned int addr, unsigned int blocklen)
422{
423const unsigned int page_size = flash->chip->page_size;
424const unsigned int total_size = flash->chip->total_size * 1024;
425const struct block_eraser be = flash->chip->block_erasers[0];
426const unsigned int sec_0a_top = be.eraseblocks[0].size;
427const unsigned int sec_0b_top = be.eraseblocks[0].size + be.eraseblocks[1].size;
428
429if ((addr + blocklen) > total_size) {
430msg_cerr("%s: tried to erase a sector beyond flash boundary: addr=%u, blocklen=%u, size=%u\n",
431 __func__, addr, blocklen, total_size);
432return 1;
433}
434
435bool partial_range = false;
436uint8_t opcode = 0x7C; /* Used for all but sector 0a. */
437if (addr < sec_0a_top) {
438opcode = 0x50;
439/* One single sector of 8 pages at address 0. */
440if (addr != 0 || blocklen != (8 * page_size))
441partial_range = true;
442} else if (addr < sec_0b_top) {
443/* One single sector of 248 pages adjacent to the first. */
444if (addr != sec_0a_top || blocklen != (248 * page_size))
445partial_range = true;
446} else {
447/* The rest is filled by 63 aligned sectors of 256 pages. */
448if ((addr % (256 * page_size)) != 0 || (blocklen % (256 * page_size)) != 0)
449partial_range = true;
450}
451if (partial_range) {
452msg_cerr("%s: cannot erase partial sectors: addr=%u, blocklen=%u\n", __func__, addr, blocklen);
453return 1;
454}
455
456/* Needs up to 4 s for completion, so let's wait 20 seconds in 200 ms steps. */
457return at45db_erase(flash, opcode, at45db_convert_addr(addr, page_size), 200000, 100);
458}
459
460static int at45db_fill_buffer1(struct flashctx *flash, const uint8_t *bytes, unsigned int off, unsigned int len)
461{
462const unsigned int page_size = flash->chip->page_size;
463if ((off + len) > page_size) {
464msg_cerr("Tried to write %u bytes at offset %u into a buffer of only %u B.\n",
465 len, off, page_size);
466return 1;
467}
468
469/* Create a suitable buffer to store opcode, address and data chunks for buffer1. */
470const int max_data_write = flash->mst->spi.max_data_write - 4;
471const unsigned int max_chunk = (max_data_write > 0 && max_data_write <= page_size) ?
472 max_data_write : page_size;
473uint8_t buf[4 + max_chunk];
474
475buf[0] = AT45DB_BUFFER1_WRITE;
476while (off < page_size) {
477unsigned int cur_chunk = min(max_chunk, page_size - off);
478buf[1] = (off >> 16) & 0xff;
479buf[2] = (off >> 8) & 0xff;
480buf[3] = (off >> 0) & 0xff;
481memcpy(&buf[4], bytes + off, cur_chunk);
482int ret = spi_send_command(flash, 4 + cur_chunk, 0, buf, NULL);
483if (ret != 0) {
484msg_cerr("%s: error sending buffer write!\n", __func__);
485return ret;
486}
487off += cur_chunk;
488}
489return 0;
490}
491
492static int at45db_commit_buffer1(struct flashctx *flash, unsigned int at45db_addr)
493{
494const uint8_t cmd[] = {
495AT45DB_BUFFER1_PAGE_PROGRAM,
496(at45db_addr >> 16) & 0xff,
497(at45db_addr >> 8) & 0xff,
498(at45db_addr >> 0) & 0xff
499};
500
501/* Send buffer to device. */
502int ret = spi_send_command(flash, sizeof(cmd), 0, cmd, NULL);
503if (ret != 0) {
504msg_cerr("%s: error sending buffer to main memory command!\n", __func__);
505return ret;
506}
507
508/* Wait for completion (typically a few ms). */
509ret = at45db_wait_ready(flash, 250, 200); // 50 ms
510if (ret != 0) {
511msg_cerr("%s: chip did not become ready again!\n", __func__);
512return ret;
513}
514
515return 0;
516}
517
518static int at45db_program_page(struct flashctx *flash, const uint8_t *buf, unsigned int at45db_addr)
519{
520int ret = at45db_fill_buffer1(flash, buf, 0, flash->chip->page_size);
521if (ret != 0) {
522msg_cerr("%s: filling the buffer failed!\n", __func__);
523return ret;
524}
525
526ret = at45db_commit_buffer1(flash, at45db_addr);
527if (ret != 0) {
528msg_cerr("%s: committing page failed!\n", __func__);
529return ret;
530}
531
532return 0;
533}
534
535int spi_write_at45db(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len)
536{
537const unsigned int page_size = flash->chip->page_size;
538const unsigned int total_size = flash->chip->total_size;
539
540if ((start % page_size) != 0 || (len % page_size) != 0) {
541msg_cerr("%s: cannot write partial pages: start=%u, len=%u\n", __func__, start, len);
542return 1;
543}
544
545if ((start + len) > (total_size * 1024)) {
546msg_cerr("%s: tried to write beyond flash boundary: start=%u, len=%u, size=%u\n",
547 __func__, start, len, total_size);
548return 1;
549}
550
551unsigned int i;
552for (i = 0; i < len; i += page_size) {
553if (at45db_program_page(flash, buf + i, at45db_convert_addr(start + i, page_size)) != 0) {
554msg_cerr("Writing page %u failed!\n", i);
555return 1;
556}
557}
558return 0;
559}

Archive Download this file

Revision: HEAD